# Data Processing Agreement

Version: 1.0.4 - Effective: 21 October 2026

This Data Processing Agreement ("DPA") is part of the [Terms of Service](/terms) between **SetLuca, LLC** ("SetLuca", "we", the processor) and the business that uses Luca ("Coach", "you", the controller). It applies when we process personal data on your behalf as part of Luca, mainly the data of the people who message you ("leads").

It's written to meet Article 28 of the EU General Data Protection Regulation (GDPR), the UK GDPR, and similar laws, including the "service provider" rules of US state privacy laws. If this DPA conflicts with the Terms on how we process your leads' data, this DPA wins. If the Standard Contractual Clauses apply and conflict with this DPA, the Clauses win.

## 1. Roles

- **You are the controller** of Customer Personal Data: the personal data of your leads and any other people whose data comes into Luca through your connected channels, integrations, or uploads.
- **We are your processor.** We process Customer Personal Data only to provide Luca to you.
- **Where we are a controller.** For your account, billing, our website, our analytics, security, and support, SetLuca is a separate controller and our [Privacy Policy](/privacy) applies.

Details of the processing (subject matter, duration, nature, purposes, data, and people) are in **Annex 1**.

## 2. Your instructions

We process Customer Personal Data only on your documented instructions. Your instructions are: these terms; your configuration and use of Luca (connecting channels, choosing auto-send or review, setting up campaigns, broadcasts, follow-ups, bookings, automations, and integrations); and any other written instruction we agree to. Whether a channel uses auto-send or review is your instruction. Auto-send is on by default for every channel, and you can switch any channel to review at any time. Keeping the default setting for a channel is also your instruction.

If the law requires us to process data otherwise, we'll tell you first unless the law forbids it. We'll tell you if we believe an instruction breaks data protection law, and we may refuse to follow it.

## 3. Your responsibilities

You're responsible for the lawfulness of the processing you instruct. In particular, you must:

1. **Have a lawful basis** under GDPR Art. 6 for processing your leads' data and for each type of message you send, including follow-ups, broadcasts, and marketing, and get consent where the law or a platform requires it.
2. **Inform your leads** (GDPR Arts. 13 and 14). Your leads don't give their data to us; they message you. You must tell them, in your own privacy notice, that you use a service provider and AI to handle messages, what you do with their data, and how they can exercise their rights. Make that notice easy to find from each channel (for example, a link in your bio or profile).
3. **Set a privacy policy for each Telegram bot.** Telegram requires every bot to have one. Telegram's standard bot policy doesn't cover storing messages or processing them with AI through Luca, so you must publish your own and register it in @BotFather (Edit Bot -> Edit Privacy Policy).
4. **Handle special-category data lawfully (GDPR Art. 9).** Coaching conversations often contain health information (fitness, nutrition, weight, mental health, pregnancy) even when you don't ask for it. You decide whether this data may be processed in Luca and must have a valid Art. 9(2) condition for it, normally the lead's explicit consent. Don't use Luca to ask for health data you don't need. Luca flags some sensitive messages as urgent and holds them from auto-send, but only in English today, and it doesn't screen or exclude special-category data. These flags aren't a compliance control.
5. **Not process children's data or regulated medical records** in Luca (see the Terms).
6. **Disclose AI where required.** Make sure leads are told they're interacting with an AI system where the law requires it (EU AI Act Art. 50), and never present Luca as a human. Luca itself never claims to be a person, and if a lead asks whether they're talking to an AI, it says so.
7. **Follow platform rules**, including Meta's 24-hour messaging window and messaging policies and Telegram's Bot Platform rules.
8. **Respond to your leads' requests.** Lead requests to access, correct, delete, or object are yours to decide. We'll help as described in section 7.

## 4. Confidentiality

Everyone at SetLuca, and every contractor, who can access Customer Personal Data is bound by confidentiality and gets access only as needed for their role.

## 5. Security

We implement the technical and organizational measures in **Annex 2**, taking into account the state of the art, cost, and the risks to people (GDPR Art. 32). We may update them as long as the overall level of protection doesn't go down.

## 6. Subprocessors

You give us general authorization to use subprocessors. The current list, with each one's purpose, data, location, and transfer mechanism, is on our [providers page](/providers) (section 1) and summarized in **Annex 3**.

- We sign a written contract with each subprocessor that gives Customer Personal Data protections at least as strong as this DPA.
- We'll tell the account owner by email at least **30 days** before a new subprocessor starts processing Customer Personal Data, and update the providers page.
- You can object on reasonable data-protection grounds within that period, by writing to [support@setluca.com](mailto:support@setluca.com). We'll try to resolve it, for example by not using that subprocessor for your data. If we can't, you can terminate the affected service and get a refund of prepaid fees for the unused period.
- In an emergency (for example, a provider failure or security issue), we may replace a subprocessor at shorter notice and tell you as soon as we can.
- We remain responsible to you for our subprocessors' performance.

**Platforms you connect aren't our subprocessors.** Meta (Instagram, Messenger, WhatsApp), Telegram, calendars, webhook endpoints, and AI assistants you connect through our MCP server process data under their own terms. You choose them, and sending them data is your instruction.

## 7. Helping you meet your obligations

Taking into account the nature of the processing, we'll help you:

- **answer lead requests** (access, correction, deletion, restriction, portability, objection), through Luca's features and by email. If a lead contacts us directly, we'll pass the request to you without undue delay and won't answer it ourselves unless you tell us to or the law requires it;
- with **security**, **breach notification**, **data protection impact assessments**, and **prior consultation** with an authority (GDPR Arts. 32 to 36), with the information we reasonably have.

We may charge a reasonable fee for help that goes beyond what Luca's features and normal support provide, where the law allows.

## 8. Personal data breaches

If we become aware of a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data, we'll notify you **without undue delay, and in any case within 48 hours** of becoming aware of it, by email to the account owner. We'll tell you what we know (the nature of the breach, the categories and approximate number of people and records concerned, likely consequences, and the measures taken or proposed) and send updates as we learn more. Notifying you isn't an admission of fault. You're responsible for notifying authorities and leads where the law requires; we'll help. To report a suspected breach or security issue to us, write to [support@setluca.com](mailto:support@setluca.com).

## 9. International transfers

We process Customer Personal Data in the United States and in other countries listed on the [providers page](/providers). For transfers of Customer Personal Data from the EEA to a country without an adequacy decision, the parties agree to the **Standard Contractual Clauses** adopted by Commission Implementing Decision (EU) 2021/914, which are incorporated by reference:

- **Module Two** (controller to processor), where you are a controller in the EEA and we receive the data in the United States;
- **Module Three** (processor to processor), for our transfers to subprocessors, unless a subprocessor is certified under the EU-US Data Privacy Framework or another valid mechanism applies.

For the Clauses: Clause 7 (docking) applies; Clause 9 option 2 (general authorization, with the notice period in section 6); Clause 11 optional language doesn't apply; Clause 17 (option 1): the law of Spain; Clause 18: the courts of Madrid, Spain. The Delaware choice in section 21 of the Terms doesn't apply to the Clauses. Annexes I to III of the Clauses are filled in by Annexes 1 to 3 of this DPA. For UK and Swiss transfers, the UK International Data Transfer Addendum and the Swiss amendments apply.

## 10. Deletion and return at the end

For **30 days after you cancel**, you can download your conversation history from Luca or ask for an export of Customer Personal Data at [support@setluca.com](mailto:support@setluca.com). We delete Customer Personal Data after the plan ends, on the schedule in our [Privacy Policy](/privacy). Copies in backups and logs expire on each provider's schedule. On request, we'll confirm deletion in writing.

Deleting a channel's data through Meta's data-deletion request works as described on our [data deletion page](/data-deletion).

## 11. Audits

We'll make available the information reasonably needed to show we meet this DPA, such as this DPA, our providers list, security descriptions, and our subprocessors' certifications or audit reports where we're allowed to share them.

If that isn't enough, or an authority requires it, you (or an independent auditor bound by confidentiality, who isn't our competitor) may audit our compliance once a year, with at least **30 days'** written notice to [support@setluca.com](mailto:support@setluca.com), during business hours, without disrupting the service or accessing other customers' data. You pay for the audit unless it finds a material breach by us. We may meet an audit request by providing a recent independent report covering the same scope.

## 12. US state privacy laws

Where US state privacy laws apply, we're your "service provider" or "processor". We won't sell or share Customer Personal Data, retain, use, or disclose it outside our direct business relationship with you or for any purpose other than providing Luca, or combine it with personal data from other sources except as those laws allow. We'll tell you if we can no longer meet these obligations. You may take reasonable steps to stop and fix unauthorized use.

## 13. AI models and Customer Personal Data

We send Customer Personal Data to AI models only to perform the service for you. We don't use it to train or fine-tune AI models shared with other customers, and we configure model requests to go only to providers that don't store prompts or train on them. Your voice profile and writing-style samples are used only for your workspace.

## 14. Liability and term

Each party's liability under this DPA is subject to the limitations in section 18 of the Terms (the greater of 12 months' fees or US$100, with the carve-outs listed there), except where the law doesn't allow it.

**Notices.** Notices under this DPA go to the account owner's email from us, and to [support@setluca.com](mailto:support@setluca.com) from you. This DPA lasts as long as we process Customer Personal Data for you, and ends when we've deleted or returned it.

## Annex 1: Details of the processing

| **Controller (data exporter)** | The Coach, as identified in their Luca account. Contact: the account owner's email. Activity: coaching, creator, or expert business selling through direct messages |
| --- | --- |
| **Processor (data importer)** | SetLuca, LLC, 2810 North Church Street, Wilmington, DE 19802, US (Delaware file number 10724331); contact for data protection, DPA notices, and breaches: support@setluca.com. Activity: provider of the Luca software service |
| **Subject matter** | Providing Luca: receiving, storing, analyzing, drafting, and sending messages for the Coach |
| **Duration** | The term of the Coach's plan, plus the deletion periods in section 10 |
| **Nature of processing** | Collection through connected channels, storage, organization, AI analysis (classification, qualification, summarization, transcription, embeddings), drafting, sending, scheduling, export, and deletion |
| **Purposes** | Answering and organizing inbound messages; drafting replies in the Coach's voice; automatic or reviewed sending; follow-ups, broadcasts, and comment campaigns the Coach sets up; booking calls; analytics for the Coach; Ask Luca answers about the Coach's own workspace |
| **People whose data is processed** | Leads and prospects who message or comment on the Coach's connected accounts; people mentioned in those messages; the Coach's team members whose names appear on sends; the Coach's own replies (writing-style samples) |
| **Categories of personal data** | Names, usernames, platform-scoped IDs, profile details the platform provides; message and comment content; attachments, images, voice notes and transcripts; qualification answers (goals, budget, timeline); bookings (name, time, contact details collected); consent and opt-out status; summaries and memories; delivery and interaction data |
| **Special categories** | Not intended, but may be included in messages: health data in particular, and possibly data on religion, sexual life, or other special categories a lead chooses to share. Safeguards: Annex 2, section 3(4) of this DPA, urgent-flagging of some sensitive messages, restricted access, no use for model training |
| **Frequency** | Continuous, while channels are connected |
| **Retention** | See section 10 and our [Privacy Policy](/privacy) |
| **Transfers to subprocessors** | As listed in Annex 3, for the purposes stated there |

## Annex 2: Technical and organizational measures

- **Encryption:** TLS for data in transit; connected-platform credentials encrypted at rest in the application; provider-level encryption at rest for database and storage.
- **Access control:** tenant scoping and authorization checks on every workspace request; team roles (owner, admin, manager, operator, analyst, viewer); least-privilege access for staff; self-hosted services (background jobs, tracing) reachable only through Cloudflare Tunnel and Cloudflare Access with an allowlist and service tokens, with no public ports.
- **Secrets:** stored in a secrets manager (Infisical), not in code.
- **Minimization in diagnostics:** error reports exclude default personal data; names, emails, tokens, and message bodies are stripped or redacted before sending; where session replay is enabled, it masks all text and inputs and blocks media.
- **AI processing:** only task-needed context is sent; model requests are configured to go only to providers that don't store or train on prompts; transcription requires zero data retention.
- **Safety gates on sending:** platform messaging windows enforced; urgent messages held from auto-send; a draft check before sending; human-pace sending limits.
- **Deletion:** Meta data-deletion callback with signed-request verification and a public status page; scheduled purges (raw platform payloads 7 days; analytics events 90 days; writing-style samples 30 days after the plan ends, or when the Coach disconnects the channel they were imported from); leads and conversations deleted on request, when the Coach disconnects the channel, or when the Coach deletes their account; once our automatic purge is switched on, we aim to delete them within 90 days of the plan ending.
- **Resilience:** managed database with automated backups; monitoring and alerting.
- **Organizational:** confidentiality obligations for everyone with access; vendor review before adding a subprocessor; a maintained list of providers.

## Annex 3: Subprocessors

The authoritative, current list is on our [providers page](/providers), section 1. At the effective date it is:

| Subprocessor | Purpose | Location |
| --- | --- | --- |
| OpenRouter, Inc. (and the upstream model providers it routes to, described on our providers page) | AI model routing for reading, drafting, summarizing, classifying, transcription, Ask Luca | United States |
| Cloudflare, Inc. | Hosting, Workers, R2 storage, KV, Workers AI embeddings, network security, Tunnel and Access | Global / United States |
| PlanetScale, Inc. | Database | United States |
| Hetzner Online GmbH | Hosting of self-hosted background jobs (Inngest) and AI tracing (Langfuse, off by default) | Germany |
| Functional Software, Inc. (Sentry) | Error monitoring, logs, app session replay (masked) | United States (Google Cloud) |
| Plus Five Five, Inc. (Resend) | Email notifications to the Coach that may include lead names or snippets | United States |
| Infisical, Inc. | Secrets management (channel access tokens) | United States |
| PostHog, Inc. | Pseudonymous product analytics (workspace-level counts and channel; no message content, names, handles or emails) | United States |